sds: preserve input when printf growth fails

[edsiper]

Summary

Restore the original SDS terminator before cfl_sds_printf() attempts to
grow its buffer.

Background

vsnprintf() writes a truncated result when the available capacity is
insufficient. If the subsequent allocation failed, cfl_sds_printf() returned
NULL while leaving bytes beyond the recorded SDS length modified and the
terminator invariant broken.

The original terminator is now restored before growth and on formatting
errors, so failure leaves the input SDS valid and unchanged from the caller's
perspective.

A regression test also covers appending formatted content to an existing
prefix while the SDS grows.

Validation

• Focused SDS unit test
• Full test suite: 34/34 passed
• ASan/UBSan focused SDS test with leak detection
• git diff --check